KR102051350B1 - Method and system for data acquisition for analyzing transaction of cryptocurrency - Google Patents

Abstract

The present invention relates to a method and an apparatus for acquiring data for generating a machine learning model for detecting fraudulent accounts for cryptocurrency. The method for acquiring data for generating a machine learning model for detecting fraudulent accounts for cryptocurrency comprises the steps of: receiving a report relating to a fraudulent address from a first database that stores information about the reported fraudulent address; acquiring a first fraudulent address and first description associated with the first fraudulent address from the report; extracting a plurality of first key words associated with the first fraudulent address from the first description by using natural language processing; and storing the first fraudulent address in a second database.

Description

METHOD AND SYSTEM FOR DATA ACQUISITION FOR ANALYZING TRANSACTION OF CRYPTOCURRENCY}

The present disclosure relates to a method and apparatus for acquiring learning data to generate a machine learning model for detecting fraudulent accounts of cryptocurrencies.

Cryptocurrency is a digital asset that is designed to function as an exchange. It is electronic information that is encrypted and distributed by blockchain technology and can be used as money in certain networks. Cryptocurrencies are electronic information, in which digital values are digitally represented based on blockchain technology, not issued by the central bank, and are distributed and managed in a P2P manner over the Internet. The key technique for issuing and managing cryptocurrencies is blockchain technology. Blockchain is a list of records (blocks) that continues to grow, and blocks are secured by connecting them using encryption. Each block typically contains the cryptographic hash, timestamp and transaction data of the previous block. Blockchain is a publicly available distributed ledger that is resistant to data modifications from the outset and can prove a permanent and valid transaction between both parties. Therefore, cryptocurrency enables transparent operation based on tamper proof.

In addition, the cryptocurrency has anonymity, unlike the existing currency, so that third parties other than the giver and the receiver cannot know the transaction details at all. Because of the anonymity of the account, it is difficult to track the flow of transactions (Non-trackable), and all records such as remittance records and collection records are public, but the transaction subjects are unknown.

Cryptocurrency is considered as an alternative to the existing key currency due to the above-mentioned freedom and transparency, and it can be effectively used for international transactions with low fees and simple remittance procedures compared to the existing currency. However, due to its anonymity, cryptocurrencies may be used as criminal means, such as in fraudulent transactions.

On the other hand, the data of the cryptocurrency transaction is enormous and it is difficult to determine the fraud subject by manually determining the characteristics of the fraudulent transaction. In this regard, machine learning can be used to automatically learn the relationships between vast amounts of data.

Therefore, there is a need for a method that can identify the subject of a transaction that uses cryptocurrency as a criminal means using machine learning.

According to the present disclosure, a method of acquiring learning data for generating a machine learning model for detecting a fraudulent account of a cryptocurrency includes receiving a report related to a fraudulent address from a first database storing information on a reported fraudulent address. Obtaining a first description associated with the first fraudulent address and the first fraudulent address from the report, using natural language processing, the plurality of first associated with the first fraudulent address in the first description; Extracting the first key words and storing the first fraudulent address in a second database.

The method for acquiring learning data according to the present disclosure includes receiving text information from a publicly accessible website, extracting main text information including a cryptocurrency address from the text information, and using main language processing. Extracting a plurality of second key words from the terminal, obtaining a fraud detection model, and determining whether the cryptographic address included in the main text is a fraud address by applying the plurality of second key words to the fraud information detection model If the cryptographic address is a fraudulent address, obtaining the cryptographic address as a second fraudulent address and storing the second fraudulent address in a second database.

Acquiring a fraud detection model of the method for acquiring the training data according to the present disclosure may include obtaining words related to a good cryptographic address obtained from a website determined to include a good cryptographic address, and a good cryptocurrency. Obtaining a first frequency each of the words associated with the address appear on a website, obtaining a second frequency each of the first key words represents in the first description, and a word associated with a good cryptographic address labeled as good. For example, the first frequency, the second frequency and a plurality of first key words labeled as fraudulent machine learning to obtain a fraud information detection model.

The method for acquiring learning data according to the present disclosure includes obtaining a second description from a service providing a tag corresponding to a cryptocurrency address, and obtaining a fraudulent key word set based on the plurality of first key words. If the word included in the fraud key word set is described in the second description, determining the cryptographic address corresponding to the second description as the third fraud address, and storing the third fraud address in the second database. Characterized in that it comprises a.

Acquiring a fraudulent key word set of the method of acquiring learning data according to the present disclosure may include obtaining a frequency appearing in the first description for each of the plurality of first key words and a plurality of first key words. Determining a predetermined number of words having a high frequency as a fraudulent key word set.

The method of acquiring learning data according to the present disclosure may include obtaining score information indicating a reliability of an address from a service providing a tag corresponding to a cryptocurrency address, indicating that the score information is favorable, and If the description does not include the words included in the fraudulent key word set, determining the cryptographic address as a good address, the score information indicates scam, and the second description contains the words included in the fraudulent key word set. If included, further comprising determining the cryptographic address as a third fraud address and storing the good address and the third fraud address in a second database.

An apparatus for acquiring learning data for generating a machine learning model for detecting a fraudulent account of a cryptocurrency according to the present disclosure includes a processor and a memory, the processor according to an instruction stored in the memory, for a reported fraud address. Receiving a report relating to a fraudulent address from a first database storing information, obtaining a first description associated with the first fraudulent address and the first fraudulent address from the report, Natural Language Processing Extracting the plurality of first key words related to the first fraudulent address from the first description and storing the first fraudulent address in a second database.

A processor of an apparatus for acquiring learning data according to the present disclosure may be configured to receive text information from a publicly accessible website according to an instruction stored in a memory, and extract main text information including a cryptocurrency address from the text information. Extracting a plurality of second key words from the main text information using natural language processing, acquiring a fraud detection model, and applying a plurality of second key words to the fraud information detection model Determining whether the monetary address is a fraudulent address, if the cryptographic address is a fraudulent address, obtaining a cryptographic address as a second fraudulent address, and storing the second fraudulent address in a second database. do.

The processor of the apparatus for acquiring learning data according to the present disclosure, according to the instructions stored in the memory, obtaining words related to a good cryptographic address obtained from a website determined to include a good cryptographic address, a good cryptographic address. Obtaining a first frequency with each of the words associated with the website appearing, obtaining a second frequency with each of the first key words represented in the first description, and words associated with a good cryptographic address labeled as good. And machine learning a plurality of first key words labeled first frequency, second frequency, and fraud to obtain a fraud information detection model.

The processor of the apparatus for acquiring learning data according to the present disclosure may include obtaining a second description from a service for providing a tag corresponding to a cryptocurrency address according to an instruction stored in a memory, and a plurality of first key words. Obtaining a fraud key word set based on the step, if the words included in the fraud key word set are described in the second description, determining the cryptographic address corresponding to the second description as the third fraud address, and the third fraud Storing the address in a second database.

The processor of the apparatus for acquiring learning data according to the present disclosure may include acquiring a frequency appearing in the first description for each of the plurality of first key words according to an instruction stored in a memory, and among the plurality of first key words. And determining a predetermined number of words having a high frequency as a fraudulent key word set.

The processor of the apparatus for acquiring learning data according to the present disclosure obtains score information indicating reliability of an address from a service providing a tag corresponding to a cryptocurrency address according to an instruction stored in a memory, Indicating good and if the second description does not include a word included in the fraudulent key word set, determining the cryptographic address as a good address, the score information indicates a scam, and the second description If a word included in the fraudulent key word set is included, determining the cryptographic address as the third fraud address and storing the good address and the third fraud address in a second database.

In addition, a program for implementing the method of acquiring learning data as described above may be recorded in a computer-readable recording medium.

1 is a block diagram of an apparatus for acquiring learning data according to an embodiment of the present disclosure.
2 is a diagram illustrating an apparatus for acquiring learning data according to an embodiment of the present disclosure.
3 is a flowchart illustrating an operation of a learning data acquisition apparatus according to an embodiment of the present disclosure.
4 is a view for explaining the operation of the learning data acquisition apparatus according to an embodiment of the present disclosure.
5 is a flowchart illustrating an operation of a learning data acquisition apparatus according to an embodiment of the present disclosure.
6 is a view for explaining the operation of the learning data acquisition apparatus according to an embodiment of the present disclosure.
7 is a flowchart illustrating a method of obtaining a fraud information detection model according to an embodiment of the present disclosure.
8 is a flowchart illustrating an operation of a learning data acquisition apparatus according to an embodiment of the present disclosure.
9 is a flowchart illustrating an operation of a learning data acquisition apparatus according to an embodiment of the present disclosure.
10 is a view for explaining the operation of the learning data acquisition apparatus according to an embodiment of the present disclosure.
11 is a view showing a configuration for deriving a machine learning model according to an embodiment of the present disclosure.

Advantages and features of the disclosed embodiments, and methods of achieving them will be apparent with reference to the embodiments described below in conjunction with the accompanying drawings. However, the present disclosure is not limited to the embodiments disclosed below, but may be implemented in various forms, and the present embodiments are merely provided to make the present disclosure complete, and those of ordinary skill in the art to which the present disclosure belongs. It is merely provided to fully inform the scope of the invention.

Terms used herein will be briefly described, and the disclosed embodiments will be described in detail.

The terminology used herein has been selected among general terms that are currently widely used while considering the functions of the present disclosure, but may vary according to the intention or precedent of a person skilled in the relevant field, the emergence of a new technology, and the like. In addition, in certain cases, there is also a term arbitrarily selected by the applicant, in which case the meaning will be described in detail in the description of the invention. Therefore, the terms used in the present disclosure should be defined based on the meanings of the terms and the contents throughout the present disclosure, rather than simply the names of the terms.

A singular expression in this specification includes a plural expression unless the context clearly indicates that it is singular. Also, the plural expressions include the singular expressions unless the context clearly indicates the plural.

When any part of the specification is to "include" any component, this means that it may further include other components, except to exclude other components unless otherwise stated.

Also, as used herein, the term "part" means a software or hardware component, and "part" plays certain roles. However, "part" is not meant to be limited to software or hardware. The “unit” may be configured to be in an addressable storage medium and may be configured to play one or more processors. Thus, as an example, a "part" refers to components such as software components, object-oriented software components, class components, and task components, processes, functions, properties, procedures, Subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays and variables. The functionality provided within the components and "parts" may be combined into a smaller number of components and "parts" or further separated into additional components and "parts".

According to an embodiment of the present disclosure, the “unit” may be implemented with a processor and a memory. The term “processor” should be interpreted broadly to include general purpose processors, central processing units (CPUs), microprocessors, digital signal processors (DSPs), controllers, microcontrollers, state machines, and the like. In some circumstances, a “processor” may refer to an application specific semiconductor (ASIC), a programmable logic device (PLD), a field programmable gate array (FPGA), or the like. The term "processor" refers to a combination of processing devices such as, for example, a combination of a DSP and a microprocessor, a combination of a plurality of microprocessors, a combination of one or more microprocessors in conjunction with a DSP core, or a combination of any other such configuration. May be referred to.

The term "memory" should be interpreted broadly to include any electronic component capable of storing electronic information. The term memory refers to random access memory (RAM), read-only memory (ROM), non-volatile random access memory (NVRAM), programmable read-only memory (PROM), erase-programmable read-only memory (EPROM), electrical May also refer to various types of processor-readable media, such as erasable PROM (EEPROM), flash memory, magnetic or optical data storage, registers, and the like. If the processor can read information from and / or write information to the memory, the memory is said to be in electronic communication with the processor. The memory integrated in the processor is in electronic communication with the processor.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the embodiments. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present disclosure.

1 is a block diagram of an apparatus 100 for acquiring learning data according to an embodiment of the present disclosure.

Referring to FIG. 1, the apparatus 100 for acquiring training data may include at least one of a data learner 110 and a data recognizer 120. The apparatus 100 for acquiring learning data as described above may include a processor and a memory.

The data learner 110 may learn a machine learning model for performing a target task using a data set. The data learner 110 may receive label information related to the data set and the target task. The data learning unit 110 may acquire a machine learning model by performing machine learning on the relationship between the data set and the label information. The machine learning model acquired by the data learner 110 may be a model for generating label information using a data set.

The data recognizer 120 may receive and store the machine learning model of the data learner 110. The data recognizer 120 may output label information by applying a machine learning model to the input data. In addition, the data recognizer 120 may use the input data, the label information, and the result output by the machine learning model to update the machine learning model.

At least one of the data learner 110 and the data recognizer 120 may be manufactured in the form of at least one hardware chip and mounted on the electronic device. For example, at least one of the data learner 110 and the data recognizer 120 may be manufactured in the form of a dedicated hardware chip for artificial intelligence (AI), or a conventional general purpose processor (eg, a CPU). Alternatively, the electronic device may be manufactured as a part of an application processor or a graphics processor (eg, a GPU) and mounted on the various electronic devices described above.

In addition, the data learner 110 and the data recognizer 120 may be mounted in separate electronic devices, respectively. For example, one of the data learner 110 and the data recognizer 120 may be included in the electronic device, and the other may be included in the server. In addition, the data learning unit 110 and the data recognizing unit 120 may provide machine learning model information constructed by the data learning unit 110 to the data recognizing unit 120 through wired or wirelessly, or recognize data. The data input to the unit 120 may be provided to the data learning unit 110 as additional learning data.

Meanwhile, at least one of the data learner 110 and the data recognizer 120 may be implemented as a software module. When at least one of the data learner 110 and the data recognizer 120 is implemented as a software module (or a program module including instructions), the software module may be a memory or computer readable non-readable. It may be stored in a non-transitory computer readable media. In this case, at least one software module may be provided by an operating system (OS) or by a predetermined application. Alternatively, some of the at least one software module may be provided by an operating system (OS), and others may be provided by a predetermined application.

The data learner 110 according to an exemplary embodiment of the present disclosure may include a data acquirer 111, a preprocessor 112, a training data selector 113, a model learner 114, and a model evaluator 115. It may include.

The data acquirer 111 may acquire data necessary for machine learning. Since a lot of data is required for learning, the data acquirer 111 may receive a data set including a plurality of data.

Label information may be allocated to each of the plurality of data. The label information may be information describing each of the plurality of data. The label information may be information that a target task intends to derive. Label information may be obtained from user input, from memory, or from the results of the machine learning model. For example, if the target task is to determine whether a cryptocurrency address is a fraudster's owned address from the trading history of cryptocurrency addresses, the multiple data used for machine learning will be the data related to the trading history of cryptocurrency addresses. The label information will be whether or not the cryptocurrency address is owned by the fraudster.

The preprocessor 112 may preprocess the obtained data so that the received data may be used for machine learning. The preprocessor 112 may process the acquired data set into a preset format so that the model learner 114 to be described later can use the preprocessor 112.

The training data selector 113 may select data necessary for learning from the preprocessed data. The selected data may be provided to the model learner 114. The training data selector 113 may select data required for learning from preprocessed data according to a preset criterion. In addition, the training data selector 113 may select data according to preset criteria by learning by the model learner 114 to be described later.

The model learner 114 may learn a criterion about what label information to output based on the data set. In addition, the model learner 114 may perform machine learning using the data set and the label information of the data set as the training data. In addition, the model learning unit 114 may perform machine learning by additionally using a previously acquired machine learning model. In this case, the previously acquired machine learning model may be a pre-built model. For example, the machine learning model may be a model built in advance by receiving basic learning data.

The machine learning model may be constructed in consideration of the application field of the learning model, the purpose of learning, or the computer performance of the device. The machine learning model may be, for example, a model based on a neural network. For example, models such as Deep Neural Network (DNN), Recurrent Neural Network (RNN), Long Short-Term Memory models (LSTM), Bidirectional Recurrent Deep Neural Network (BRDNN), and Convolutional Neural Networks (CNN) can be used as machine learning models. But it is not limited thereto.

According to various embodiments of the present disclosure, when there are a plurality of pre-built machine learning models, the model learning unit 114 may determine a machine learning model having a high correlation between the input learning data and the basic learning data as a machine learning model to learn. have. In this case, the basic learning data may be pre-categorized by the type of data, and the machine learning model may be built in advance by the type of the data. For example, the basic learning data may be previously classified based on various criteria such as a place where the learning data is generated, a time at which the learning data is generated, a size of the learning data, a creator of the learning data, a kind of object in the learning data, and the like.

In addition, the model learner 114 may train the machine learning model using, for example, a learning algorithm including an error back-propagation method or a gradient descent method.

In addition, the model learner 114 may learn the machine learning model through, for example, supervised learning using the training data as an input value. In addition, the model learner 114 learns unsupervised learning that finds a criterion for the target task, for example, by learning the kind of data necessary for the target task without guidance. Through this, the machine learning model can be obtained. In addition, the model learner 114 may learn the machine learning model through, for example, reinforcement learning using feedback on whether the result of the target task according to the learning is correct.

In addition, when the machine learning model is learned, the model learning unit 114 may store the learned machine learning model. In this case, the model learner 114 may store the learned machine learning model in a memory of the electronic device including the data recognizer 120. Alternatively, the model learner 114 may store the learned machine learning model in a memory of a server connected to the electronic device through a wired or wireless network.

The memory in which the learned machine learning model is stored may store, for example, instructions or data related to at least one other component of the electronic device. The memory may also store software and / or programs. The program may include, for example, a kernel, middleware, an application programming interface (API) and / or an application program (or “application”), and the like.

The model evaluator 115 may input the evaluation data into the machine learning model, and when the result output from the evaluation data does not satisfy a predetermined criterion, the model learner 114 may allow the model learner 114 to learn again. In this case, the evaluation data may be preset data for evaluating the machine learning model.

For example, the model evaluator 115 does not satisfy a predetermined criterion when the number or ratio of the evaluation data whose recognition result is not accurate among the results of the learned machine learning model for the evaluation data exceeds a preset threshold. It can be evaluated as. For example, when a predetermined criterion is defined as a ratio of 2%, the model evaluation unit 115 learns when the learned machine learning model outputs an incorrect recognition result for more than 20 evaluation data out of a total of 1000 evaluation data. The machine learning model can be evaluated as not suitable.

On the other hand, when there are a plurality of learned machine learning models, the model evaluator 115 evaluates whether each learned machine learning model satisfies a predetermined criterion, and uses the model satisfying the predetermined criterion as a final machine learning model. You can decide. In this case, when there are a plurality of models satisfying a predetermined criterion, the model evaluator 115 may determine any one or a predetermined number of models that are set in order of the highest evaluation score as the final machine learning model.

At least one of the data acquirer 111, the preprocessor 112, the training data selector 113, the model learner 114, and the model evaluator 115 in the data learner 110 is at least one. May be manufactured in the form of a hardware chip and mounted on an electronic device. For example, at least one of the data acquirer 111, the preprocessor 112, the training data selector 113, the model learner 114, and the model evaluator 115 may be artificial intelligence (AI). It may be manufactured in the form of a dedicated hardware chip, or may be manufactured as a part of an existing general purpose processor (eg, a CPU or an application processor) or a graphics dedicated processor (eg, a GPU) and mounted on the aforementioned various electronic devices.

In addition, the data acquirer 111, the preprocessor 112, the training data selector 113, the model learner 114, and the model evaluator 115 may be mounted in one electronic device or may be separate. The electronic devices may be mounted on the electronic devices. For example, some of the data acquirer 111, the preprocessor 112, the training data selector 113, the model learner 114, and the model evaluator 115 are included in the electronic device, and the rest of the data is included in the electronic device. Can be included on the server.

In addition, at least one of the data acquirer 111, the preprocessor 112, the training data selector 113, the model learner 114, and the model evaluator 115 may be implemented as a software module. A program in which at least one of the data acquirer 111, the preprocessor 112, the training data selector 113, the model learner 114, and the model evaluator 115 includes a software module (or instruction). Module may be stored on a computer readable non-transitory computer readable media. In this case, at least one software module may be provided by an operating system (OS) or by a predetermined application. Alternatively, some of the at least one software module may be provided by an operating system (OS), and others may be provided by a predetermined application.

The data recognizer 120 according to an exemplary embodiment of the present disclosure may include a data acquirer 121, a preprocessor 122, a recognition data selector 123, a recognition result provider 124, and a model updater 125. It may include.

The data acquirer 121 may receive input data. The preprocessor 122 may preprocess the acquired input data so that the acquired input data may be used by the recognition data selector 123 or the recognition result provider 124.

The recognition data selector 123 may select necessary data from the preprocessed data. The selected data may be provided to the recognition result provider 124. The recognition data selector 123 may select some or all of the preprocessed data according to a preset criterion. In addition, the recognition data selector 123 may select data according to a predetermined criterion by learning by the model learner 114.

The recognition result provider 124 may apply the selected data to the machine learning model to obtain the result data. The machine learning model may be a machine learning model generated by the model learning unit 114. The recognition result provider 124 may output result data.

The model updater 125 may cause the machine learning model to be updated based on the evaluation of the recognition result provided by the recognition result provider 124. For example, the model updater 125 may allow the model learner 114 to update the machine learning model by providing the model learner 114 with the recognition result provided by the recognition result provider 124. have.

Meanwhile, at least one of the data acquisition unit 121, the preprocessing unit 122, the recognition data selection unit 123, the recognition result providing unit 124, and the model updating unit 125 in the data recognition unit 120 is at least It may be manufactured in the form of one hardware chip and mounted on an electronic device. For example, at least one of the data acquirer 121, the preprocessor 122, the recognition data selector 123, the recognition result provider 124, and the model updater 125 may be artificial intelligence (AI). ) May be manufactured in the form of a dedicated hardware chip, or may be manufactured as a part of an existing general purpose processor (eg, a CPU or an application processor) or a graphics dedicated processor (eg, a GPU) and mounted on the aforementioned various electronic devices.

In addition, the data acquirer 121, the preprocessor 122, the recognition data selector 123, the recognition result provider 124, and the model updater 125 may be mounted in one electronic device or may be separate. May be mounted on the electronic devices. For example, some of the data obtaining unit 121, the preprocessor 122, the recognition data selecting unit 123, the recognition result providing unit 124, and the model updating unit 125 are included in the electronic device, and some of the remaining portions are included in the electronic device. May be included in the server.

In addition, at least one of the data acquirer 121, the preprocessor 122, the recognition data selector 123, the recognition result provider 124, and the model updater 125 may be implemented as a software module. At least one of the data obtaining unit 121, the preprocessor 122, the recognition data selecting unit 123, the recognition result providing unit 124, and the model updating unit 125 may include a software module (or instruction). If implemented as a program module, the software module may be stored in a computer readable non-transitory computer readable media. In this case, at least one software module may be provided by an operating system (OS) or by a predetermined application. Alternatively, some of the at least one software module may be provided by an operating system (OS), and others may be provided by a predetermined application.

Hereinafter, a method and an apparatus for receiving and processing training data by the data acquirer 111, the preprocessor 112, and the training data selector 113 of the data learner 110 will be described in more detail.

2 is a diagram illustrating an apparatus for acquiring learning data according to an embodiment of the present disclosure.

The apparatus 100 for obtaining training data may include a processor 210 and a memory 220. The processor 210 may perform instructions stored in the memory 220.

As described above, the apparatus 100 for learning data acquisition may include a data learning unit 110. The data acquirer 111, the preprocessor 112, or the learn data selector 113 of the data learner 110 may be implemented by the processor 210 and the memory 220.

Hereinafter, the learning data acquisition apparatus will be described in detail with reference to FIGS. 3 and 4.

3 is a flowchart illustrating an operation of a learning data acquisition apparatus according to an embodiment of the present disclosure. 4 is a view for explaining the operation of the learning data acquisition apparatus according to an embodiment of the present disclosure.

The training data acquisition apparatus 100 may acquire training data for generating a machine learning model for detecting a fraud account. The training data acquisition apparatus 100 may include a data acquisition unit 111, a preprocessor 112, or a training data selection unit 113.

The apparatus 100 for acquiring learning data may perform a step 310 of receiving a report related to a fraud address from a first database that stores information on a reported fraud address.

The apparatus 100 for acquiring learning data may further include a receiver 410 for receiving data from the first database 430. The receiver 410 may receive data by wire or wirelessly.

The first database 430 may be a database embedded in a service for providing a report related to a fraudulent address of cryptocurrency. In addition, the first database 430 may be a database embedded in a bitcoin scam blacklist service. For example, a service that provides a report related to a fraudulent address may be a service such as BitcoinWhosWho or BitcoinAbuse. The first database 430 stores a report for each cryptocurrency address. The training data acquisition apparatus 100 may receive a report. The apparatus 100 for learning data acquisition may determine whether the cryptographic address is a fraudulent address based on the report.

The apparatus 100 for acquiring learning data may perform an operation 320 of obtaining a first description related to the first fraud address and the first fraud address from the report.

The apparatus 100 for acquiring learning data may further include a first analyzer 420 for acquiring and processing the first fraud address and the first description associated with the first fraud address. The first analyzer may analyze data received from the first database. The first analyzer 420 may be implemented in software or hardware. The first analyzer 420 processes data different from that of the second analyzer or the third analyzer, but may be implemented in the same hardware.

The first fraudulent address may be an address of an account that can exchange cryptocurrency. The first fraudulent address may be an address determined as a cryptographic address already used for fraud by a service including the first database 430. The first description may explain in text the reason that the first fraudulent address was determined to be a fraudulent address.

The apparatus 100 for learning data acquisition may use only the first description written in a specific language. Since the first description is written in natural language, if the learning data acquisition apparatus 100 does not properly analyze the language, the accuracy of the analysis of the fraudulent address may be lowered. Therefore, the learning data acquisition apparatus 100 may use only the first description in a language that can be analyzed. But it is not limited thereto.

The apparatus 100 for acquiring learning data may perform an operation 330 of extracting a plurality of first key words related to a first fraud address from a first description using natural language processing. The cryptocurrency fraud blacklist service including the first database may be a service having high reliability in relation to fraud address determination. Accordingly, the apparatus 100 for acquiring learning data may derive the first key words from the text of the first description and analyze information related to the address of a cryptocurrency obtained from another database.

The apparatus 100 for acquiring learning data may delete characters unnecessary for analysis such as special characters, URLs, and stopwords in the first description. Further, the apparatus 100 for acquiring learning data may not use the first description when the words remaining after deleting unnecessary characters in the first description are less than a predetermined number. The predetermined number may be 15, for example. If the remaining words are less than a predetermined number, the number of words may be too small to be suitable for use as key words for determining fraudulent addresses. The apparatus 100 for acquiring learning data may increase reliability of the apparatus 100 for acquiring learning data by deleting unnecessary characters and using a first description of a predetermined number or more. In addition, the reliability of the machine learning model based on the data acquired by the learning data acquisition apparatus 100 may be increased.

The apparatus 100 for acquiring learning data may perform operation 340 of storing the first fraud address in the second database 440. The second database 440 may be included in the learning data acquisition device 100. The second database 440 may store data for generating a machine learning model. In addition, the second database 440 may store data for determining another fraudulent address and analyzing a description of the fraudulent address.

Hereinafter, a method and apparatus for obtaining information related to a fraud address and a fraudulent address from data obtained at a location other than a Bitcoin scam blacklist service will be described.

5 is a flowchart illustrating an operation of a learning data acquisition apparatus according to an embodiment of the present disclosure. 6 is a view for explaining the operation of the learning data acquisition apparatus according to an embodiment of the present disclosure.

The apparatus 100 for acquiring learning data may perform an operation 510 of receiving text information from a publicly accessible website. The apparatus 100 for acquiring learning data may receive text information from a website using the receiver 410.

The publicly accessible website 610 may include a blog that is used personally or technically. It can also be a fraud analysis report from a cyber security company. Website 610 may describe a variety of information related to the address of the cryptocurrency. For example, the website 610 may describe that the address of a specific cryptocurrency was used for fraud, that the transaction with the address of the specific cryptocurrency was satisfactory, or that the transaction was simply performed with the address of the specific cryptocurrency. have. The apparatus 100 for acquiring learning data may perform the following steps to extract content indicating that an address of a specific cryptocurrency is used for fraud.

The website 610 may not have a predetermined format unlike the first database 430. Website 610 may also include a variety of information in addition to information associated with fraudulent addresses.

The apparatus 100 for acquiring learning data may crawl a predetermined website 610. However, the present invention is not limited thereto, and the learning data acquisition apparatus 100 may automatically extract necessary data by crawling an arbitrary website 610.

The source code of the website 610 may be composed of an HTML document. The HTML document may include code related to the format for displaying the content as well as the content to be displayed on the website 610. The learning data obtaining apparatus 100 may extract the HTML body from the website 610 as text information.

The apparatus 100 for acquiring learning data may perform an operation 520 of extracting main text information including a cryptocurrency address from the text information.

The apparatus 100 for acquiring learning data may further include a second analyzer 620. The second analyzer 620 may analyze text information received from the website 610. The second analyzer 620 may be implemented in software or hardware. The apparatus 100 for acquiring training data may extract main text information using the second analyzer 620.

The apparatus 100 for acquiring learning data may use only a page including an address of a cryptocurrency among text information of the website 610. The address of a cryptocurrency may have a specific format. Accordingly, the apparatus 100 for acquiring learning data may determine whether an address of a cryptocurrency is described on the page based on the content of the page of the website 610. The apparatus 100 for acquiring learning data may remove unnecessary information from text information of a page including an address of a cryptocurrency. For example, the apparatus 100 for acquiring learning data may delete a banner and an HTML tag. To this end, the learning data acquisition apparatus 100 may use a boilerpipe.

The second analyzer 620 of the apparatus 100 for obtaining training data may perform an operation 530 of extracting a plurality of second key words from main text information using natural language processing. For example, the apparatus 100 for acquiring learning data may delete characters unnecessary for analysis such as special characters, URLs, and stopwords from the main text.

The second analyzer 620 of the apparatus 100 for obtaining training data may perform an operation 540 of obtaining a fraud information detection model. The fraud detection model may be a neural network classifier. The fraud information detection model may be a model obtained by performing machine learning. The fraud information detection model may be a machine learning model for determining whether a cryptocurrency address is being used by a fraudster based on key words related to the cryptographic address.

The training data acquisition apparatus 100 may directly generate a fraud information detection model. The training data acquisition apparatus 100 may include a data learner 110 to generate a fraud information detection model. In addition, the learning data acquisition device 100 may receive a fraud information detection model from another device. The process of generating the fraud information detection model by the learning data acquisition apparatus 100 will be described in detail with reference to FIG. 7.

The second analyzing unit 620 of the apparatus 100 for obtaining training data applies a plurality of second key words to a fraud detection model to determine whether the cryptographic address included in the main text is a fraudulent address (550). can do. In more detail, the apparatus 100 for acquiring learning data may derive a frequency in which each of the plurality of second key words appears in the main text. The apparatus 100 for acquiring learning data may apply a plurality of second key words and frequencies to a fraud information detection model. The apparatus 100 for acquiring learning data may acquire information on whether the cryptographic address included in the main text is a fraudulent address, based on the fraud information detection model.

When the cryptographic address is a fraudulent address, the second analyzer 620 of the learning data acquisition apparatus 100 may perform an operation 560 of obtaining the cryptographic address as the second fraudulent address. More specifically, when the information on whether the cryptographic address included in the main text is a fraudulent address indicates that the fraudulent address, the learning data acquisition apparatus 100 may acquire the cryptographic address included in the main text as the second fraudulent address. Can be.

The apparatus 100 for acquiring learning data may perform operation 570 for storing the second fraud address in the second database 440. The second database 440 ignores either the second fraud address or the first fraud address if the second fraud address and the first fraud address overlap, or the second fraud address or the first fraud address for either You can update the information.

7 is a flowchart illustrating a method of obtaining a fraud information detection model according to an embodiment of the present disclosure.

The apparatus 100 for acquiring learning data may perform an operation 710 of acquiring words related to a good cryptographic address obtained from a website determined to include a good cryptographic address. A good cryptographic address may indicate that it is not a cryptographic address owned by a fraudster.

A website determined to include a good cryptographic address may mean a website that provides reliability information of a cryptographic address. Cryptocurrency users can leave a review on their website after cryptocurrency transactions. The user may present the review as a score or as a text.

The user can determine which website contains a good cryptographic address. Alternatively, the learning data acquisition device 100 may automatically determine a website including a good cryptographic address. Also, the learning data acquisition apparatus 100 may obtain words related to a good cryptographic address from a web site or a web page including the good cryptographic address. For example, the learning data acquisition apparatus 100 may remove unnecessary characters from a website or a web page. The apparatus 100 for acquiring learning data may acquire words related to a good cryptographic address after removing unnecessary characters from a website or a web page. Words associated with a good cryptographic address may be key words for describing a good cryptographic address.

The apparatus 100 for acquiring learning data may perform an operation 720 of acquiring a first frequency in which words associated with a good cryptographic address appear on the website 610. The apparatus 100 for acquiring learning data may increase the accuracy of the fraud detection model based on not only words related to a good cryptographic address but also a first frequency.

Acquiring a second frequency 730 of each of the first key words associated with the preferred cryptographic address in the first description may be performed. The apparatus 100 for acquiring learning data may acquire first key words from the first database 430. Since the process of acquiring the first key words has been described with reference to FIGS. 3 and 4, a redundant description thereof will be omitted.

The apparatus 100 for acquiring learning data acquires a fraud information detection model by machine learning words associated with a good cryptographic address labeled as good, a first frequency, a second frequency, and a plurality of first key words labeled as fraud. Step 740 may be performed. The fraud detection model can learn information related to good addresses based on words associated with a first frequency and a good cryptographic address, and based on a second frequency and a plurality of first key words, You can learn related information.

The training data acquisition apparatus 100 may transmit the fraud information detection model to other training data acquisition apparatus 100 by wire or wireless. The training data acquisition apparatus 100 may store the fraud information detection model in the memory 220.

The apparatus 100 for acquiring learning data may acquire a new cryptocurrency address, frequencies of second key words and second key words corresponding to the new cryptographic address. The apparatus 100 for acquiring learning data may determine whether a new cryptocurrency address is fraudulent or good by applying the frequencies of the second key words and the second key words to a fraud detection model.

In the above, the configuration in which the learning data acquisition apparatus 100 determines the fraud address from the information described on the website using the fraud information detection model has been described, but is not limited thereto. The training data acquisition apparatus 100 may determine a good address from the information described on the website using the fraud detection model.

In addition, the method for acquiring the fraud information detection model by the training data acquisition apparatus 100 is not limited to the method described above. After reviewing a website, a user can label a webpage with a fraudulent address as "fraud" and save it with a fraudulent address, and a webpage with a good address labeled "good" and save it with a good address. have. The apparatus 100 for acquiring learning data may acquire a fraud information detection model by machine learning a fraud address, a web page labeled 'fraud', a web page labeled 'good', and a good address. The apparatus 100 for acquiring learning data may determine whether an address or an address is associated with a fraudster by simply applying a web page to a fraud detection model.

8 is a flowchart illustrating an operation of a learning data acquisition apparatus according to an embodiment of the present disclosure. 10 is a view for explaining the operation of the learning data acquisition apparatus according to an embodiment of the present disclosure.

The apparatus 100 for acquiring learning data may perform an operation 810 of obtaining a second description from a service 1010 that provides a tag corresponding to a cryptocurrency address. The apparatus 100 for acquiring learning data may acquire a second description using the receiver 410.

The tag may be meta information attached to the cryptographic address. Services that provide tags corresponding to cryptocurrency addresses may include sites such as "blockchain.info", "BitcoinTalk community" or "bitcoin-otc.com".

The tag may include a Submitted link tag, a Signed message tag, a Bitcointalk profile tag, or a Bitcoin-OTC profile tag (Bitcoin over-the-counter profile tag). The Submitted link tag provides a brief description of the tagged cryptographic address. Reporters sometimes provide fraud descriptions with page links that indicate the source of fraudulent information.

The Signed message tag provides the owner of the address. However, this identifier is chosen by the owner, so the fraudster can claim false ownership.

Bitcointalk profile tags can provide only user identifiers in the cryptocurrency community.

The Bitcoin-OTC profile tag provides a user identifier on the Bitcoin-OTC website. Unlike the Bitcointalk community, the website provides reputation scores for each user alias. This score can be given by the trading partner who performed the financial transaction with the target cryptocurrency address. It also provides a brief explanation of why the counterpart assigned a given score to a given cryptocurrency address. Therefore, the bitcoin-OTC profile tag can be used to obtain both the fraud address and the good address of the cryptocurrency.

The second description may be obtained from a Signed message tag or a Bitcoin-OTC profile tag. The second description may be textual information of the reputation associated with the cryptographic address.

The learning data obtaining apparatus 100 may perform an operation 820 of obtaining a fraudulent key word set based on the plurality of first key words.

The apparatus 100 for acquiring learning data may further include a third analyzer 1020. The third analyzer 1020 may analyze the second description received from the service 1010 that provides the tag. The second analyzer 1020 may be implemented in software or hardware. The learning data obtaining apparatus 100 may obtain a fraudulent key word set from the first key words using the second analyzer 1020.

The apparatus 100 for acquiring learning data may acquire first key words from the first database 430. Since the process of acquiring the first key words has been described with reference to FIGS. 3 and 4, a redundant description thereof will be omitted.

The fraud key word set may include only nouns. In addition, the learning data acquisition apparatus 100 may remove characters unnecessary for analysis among the first key words. For example, the apparatus 100 for acquiring learning data may delete terms related to Twitter, Tumblr, and Instagram that are not related to fraud among the first key words.

The apparatus 100 for acquiring learning data may perform a step of acquiring a frequency appearing in the first description for each of the plurality of first key words. The training data acquisition apparatus 100 may perform a step of determining a predetermined number of words having a high frequency among a plurality of first core words as a fraudulent core word set. For example, the training data acquisition apparatus 100 may be performed. May select 11 words having the highest frequency among the first key words to obtain a fraudulent key word set.

When the words included in the fraudulent key word set are described in the second description, the learning data acquiring apparatus 100 may perform an operation 830 of determining a cryptographic address corresponding to the second description as the third fraud address. . Since the number of words included in the tag is not large, the learning data acquisition apparatus 100 may determine whether the tag indicates fraud based on a fraudulent key word set derived from the first key words.

The apparatus 100 for acquiring learning data may further use the frequency on the first description of the words included in the fraudulent key word set. For example, even if the second description includes a word of a fraudulent key word set, if the word is not a word frequently appearing in the second description, the learning data acquisition apparatus 100 may convert the cryptocurrency corresponding to the second description. May not determine the address as a third fraudulent address. In addition, when the second description includes a word of a fraudulent key word set, and the word is a word frequently appearing in the second description, the learning data obtaining apparatus 100 may determine a cryptographic address corresponding to the second description. 3 can be decided by fraud address.

The apparatus 100 for acquiring training data may store 840 a third fraud address in the second database 440. The second database 440 may ignore the third fraud address, the first fraud address, or the second fraud address if the third fraud address is a duplicate of the first fraud address or the third fraud address, or the third fraud address The information on the first fraud address or the second fraud address may be updated.

9 is a flowchart illustrating an operation of a learning data acquisition apparatus according to an embodiment of the present disclosure.

FIG. 8 illustrates a case in which the learning data obtaining apparatus 100 obtains a second description from a service 1010 providing a tag. 9 illustrates a case of acquiring reliability score information of a cryptocurrency address as well as a second description.

The apparatus 100 for acquiring learning data may perform operation 910 of acquiring score information indicating the reliability of an address from a service providing a tag corresponding to a cryptocurrency address. The score information representing the reliability of the address may be a score left by the counterpart of the cryptocurrency address. In addition, when a plurality of trading partners leave scores, the average of the scores may be score information indicating the reliability of the address.

When the learning data obtaining apparatus 100 indicates that the score information is good and the word included in the fraudulent key word set is not included in the second description, determining the cryptographic address as the good address (920). Can be done. The learning data obtaining apparatus 100 may determine that the score information indicates goodness when the score information is greater than or equal to a threshold value. However, the present invention is not limited thereto, and the learning data acquisition apparatus 100 may determine that the score information indicates goodness when the score information is less than or equal to the threshold value.

When the score information indicates scam and the second description includes a word included in the fraud key word set, the learning data obtaining apparatus 100 determines the cryptographic address as the third fraud address (930). Can be performed. When the score information is less than or equal to the threshold value, the apparatus 100 for learning data acquisition may determine that it represents fraud. However, the present invention is not limited thereto, and the learning data acquisition apparatus 100 may determine that the score information indicates fraud when the score information is greater than or equal to a threshold value.

The apparatus 100 for acquiring learning data indicates that the score information indicates fraud but the second description does not include a word included in the fraud key word set, or that the score information indicates good but includes the fraud key word set in the second description. If a word is included, the decision on the crypto address can be withheld. The learning data obtaining apparatus 100 determines the cryptocurrency address as a good address or a fraudulent address only when it is certain, so that the machine learning may be performed based on certain data later.

The apparatus 100 for acquiring learning data may perform operation 940 of storing the good address and the third fraud address in the second database 440. The second database 440 may ignore the third fraud address, the first fraud address, or the second fraud address if the third fraud address is a duplicate of the first fraud address or the third fraud address, or the third fraud address The information on the first fraud address or the second fraud address may be updated.

11 is a view showing a configuration for deriving a machine learning model according to an embodiment of the present disclosure.

So far, the method of deriving the first fraud address, the second fraud address, the third fraud address, and the good address from the learning data obtaining apparatus 100 has been described. The data learner 110 may perform machine learning based on the data stored in the second database 440 and derive the machine learning model 1130.

The data learning unit 110 may use information related to the first fraud address, the second fraud address, and the good address, as well as the first fraud address, the second fraud address, the third fraud address, and the good address. have. Information relating to the first fraud address, the second fraud address, the third fraud address and the good address may include a transaction history. The transaction history may include the date and time of the transaction, the address of the counterpart or the amount of the transaction.

The data learning unit 110 may analyze the information related to the first fraud address, the second fraud address, the third fraud address, and the good address to obtain characteristics of the addresses. The data learning unit 110 may perform machine learning using the features of the addresses and generate the machine learning model 1130.

The data learning unit 110 may store the generated machine learning model 1130 in a memory or transmit it to another device. The data recognizer 120 may determine whether the cryptocurrency address is a fraudulent address based on the machine learning model 1130. The data recognition unit 120 may receive a new cryptocurrency address and determine whether the cryptographic address is a fraudulent address by applying the new cryptographic address to the machine learning model 1130.

So far I looked at the center of the various embodiments. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

Meanwhile, the above-described embodiments of the present invention can be written as a program that can be executed in a computer, and can be implemented in a general-purpose digital computer that operates the program using a computer-readable recording medium. The computer-readable recording medium includes a storage medium such as a magnetic storage medium (eg, a ROM, a floppy disk, a hard disk, etc.) and an optical reading medium (eg, a CD-ROM, a DVD, etc.).

Claims (12)

In the learning data acquisition apparatus, Method for acquiring learning data for generating a machine learning model for detecting fraudulent accounts of cryptocurrency
Receiving a report associated with a fraudulent address from a first database that stores information about the reported fraudulent address;
Obtaining a first description of a fraud address and a first description associated with the first fraud address from the report;
Extracting a plurality of first key words associated with a first fraudulent address from the first description using natural language processing;
Storing the first fraudulent address in a second database;
Receiving textual information from a publicly accessible website;
Extracting main text information including a cryptocurrency address from the text information;
Extracting a plurality of second key words from the main text information using natural language processing;
Obtaining a fraud information detection model;
Determining whether a cryptographic address included in the main text is a fraudulent address by applying the plurality of second key words to the fraud detection model;
If the cryptographic address is a fraudulent address, obtaining the cryptographic address as a second fraudulent address; And
And storing the second fraudulent address in the second database.
delete The method of claim 1,
Acquiring the fraud information detection model,
Obtaining words associated with a good cryptographic address obtained from a website determined to include a good cryptographic address;
Obtaining a first frequency in which each of the words associated with the good cryptographic address appears on a website;
Obtaining a second frequency each of said first key words represents in said first description; And
Machine learning words associated with the good cryptographic address labeled good, a first frequency, a second frequency, and the plurality of first key words labeled fraud to obtain the fraud detection model. Learning data acquisition method characterized in that.
The method of claim 1,
Obtaining a second description from a service providing a tag corresponding to a cryptocurrency address;
Obtaining a fraudulent key word set based on the plurality of first key words;
If a word included in the fraud key word set is described in the second description, determining a cryptographic address corresponding to the second description as a third fraud address; And
And storing the third fraud address in the second database.
The method of claim 4, wherein
Acquiring the fraud key word set,
Obtaining a frequency appearing in the first description for each of the plurality of first key words; And
And determining a predetermined number of words having a high frequency among the plurality of first key words as the fraudulent key word set.
The method of claim 4, wherein
Obtaining score information indicating the reliability of the address from a service providing a tag corresponding to the cryptographic address;
Determining the cryptographic address as a good address when the score information indicates a good benign and the second description does not include a word included in the fraudulent key word set;
Determining the cryptographic address as the third fraud address when the score information indicates a scam and the second description includes a word included in the fraud key word set; And
And storing the good address and the third fraud address in the second database.
Apparatus for acquiring learning data for generating a machine learning model for detecting fraudulent accounts of cryptocurrency,
Includes a processor and memory,
The processor according to the instructions stored in the memory,
Receiving a report associated with a fraudulent address from a first database that stores information about the reported fraudulent address;
Obtaining a first description of a fraud address and a first description associated with the first fraud address from the report;
Extracting a plurality of first key words associated with a first fraudulent address from the first description using natural language processing;
Storing the first fraudulent address in a second database;
Receiving textual information from a publicly accessible website;
Extracting main text information including a cryptocurrency address from the text information;
Extracting a plurality of second key words from the main text information using natural language processing;
Obtaining a fraud information detection model;
Determining whether a cryptographic address included in the main text is a fraudulent address by applying the plurality of second key words to the fraud detection model;
If the cryptographic address is a fraudulent address, obtaining the cryptographic address as a second fraudulent address; And
And storing the second fraudulent address in the second database.
delete The method of claim 7, wherein
The processor according to the instructions stored in the memory,
Obtaining words associated with a good cryptographic address obtained from a website determined to include a good cryptographic address;
Obtaining a first frequency in which each of the words associated with the good cryptographic address appears on a website;
Obtaining a second frequency each of said first key words represents in a first description; And
Machine learning words associated with the good cryptographic address labeled good, a first frequency, a second frequency, and the plurality of first key words labeled fraud to obtain the fraud detection model. Learning data acquisition device characterized in that.
The method of claim 7, wherein
The processor according to the instructions stored in the memory,
Obtaining a second description from a service providing a tag corresponding to a cryptocurrency address;
Obtaining a fraudulent key word set based on the plurality of first key words;
If a word included in the fraud key word set is described in the second description, determining a cryptographic address corresponding to the second description as a third fraud address; And
And storing the third fraud address in the second database.
The method of claim 10,
The processor according to the instructions stored in the memory,
Obtaining a frequency appearing in the first description for each of the plurality of first key words; And
And determining a predetermined number of words having a high frequency among the plurality of first key words as the fraudulent key word set.
The method of claim 10,
The processor according to the instructions stored in the memory,
Obtaining score information indicating the reliability of the address from a service providing a tag corresponding to the cryptographic address;
Determining the cryptographic address as a good address when the score information indicates a good benign and the second description does not include a word included in the fraudulent key word set;
Determining the cryptographic address as the third fraud address when the score information indicates a scam and the second description includes a word included in the fraud key word set; And
And storing the good address and the third fraud address in the second database.

Images